Heartbeat-Driven Log Integrity Verification in SOC Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional information processing devices face challenges in ensuring the integrity of monitoring log transmission to a security operation center, as anomalies may not be reliably detected and addressed due to potential compromises in the monitoring system.
Innovation Solution
An information processing device is designed with a transmitter to communicate external logs, a first monitor for internal processing integrity verification, and a second monitor that outputs a heartbeat signal and stops it when anomalies are detected, allowing the external device to detect compromises.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single monitor is used to verify internal processing integrity and transmit logs, then the device complexity is low, but the reliability of anomaly detection is insufficient when the monitor or transmitter is compromised
Solution Approach 1:
The monitoring function is divided into two independent monitors: a first monitor that verifies internal processing integrity and a second monitor that verifies the first monitor's integrity and generates heartbeat signals. This segmentation ensures that a compromise of one monitor does not affect the other, thereby improving anomaly detection reliability while maintaining manageable system complexity through clear functional separation.
Solution Approach 2:
The second monitor acts as an intermediary between the first monitor and the external device. It verifies the first monitor's integrity and controls heartbeat signal transmission, preventing a compromised first monitor from directly communicating with external devices. This intermediary layer adds reliability without significantly increasing overall system complexity.
2Reliability
If the monitor continuously transmits logs to the external device, then the external device can monitor system status, but the integrity of transmitted logs cannot be ensured when the transmitter is compromised
Solution Approach 1:
The second monitor provides feedback control by continuously outputting heartbeat signals to the transmitter and monitoring their successful transmission. When the transmitter is compromised or stops functioning properly, the absence of heartbeat signal transmission serves as feedback to stop log transmission, thereby ensuring the integrity of transmitted logs while using a relatively simple transmission control mechanism.
Solution Approach 2:
The second monitor performs preliminary verification of the first monitor's integrity before allowing log transmission to proceed. By checking integrity in advance and controlling heartbeat signal transmission, the system prevents compromised logs from being transmitted, ensuring log integrity without requiring complex real-time transmission control mechanisms.
3Measurement precision
If the first monitor directly transmits anomaly information to the external device, then the transmission is simple, but the external device cannot distinguish between legitimate and compromised transmissions
Solution Approach 1:
The second monitor serves as an intermediary verification layer between the first monitor and the external device. It verifies the first monitor's integrity and controls the transmission of anomaly information through heartbeat signals. This intermediary layer enables the external device to distinguish between legitimate and compromised transmissions by validating the heartbeat signal source, thereby improving anomaly detection accuracy while maintaining manageable verification complexity through a clear two-layer structure.
Data Source
AI summary
An information processing device includes: a log transmitter that transmits a monitoring log generated in the information processing device to an SOC (28); an HIDS monitor that verifies an integrity of the log transmitter; and a monitoring RoT that verifies an integrity of the HIDS monitor, and repeatedly outputs a heartbeat signal to the log transmitter. Each time the heartbeat signal is output from the monitoring RoT, the log transmitter transmits the heartbeat signal to the SOC. When the integrity of the log transmitter is anomalous, the HIDS monitor outputs, to the monitoring RoT, an output stop request signal for requesting the monitoring RoT to stop outputting the heartbeat signal. The monitoring RoT stops outputting the heartbeat signal based on the output stop request signal.